You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by jo...@apache.org on 2024/05/09 09:05:38 UTC
svn commit: r1917600 - in /httpd/httpd/trunk: docs/manual/mod/mod_ssl.xml modules/ssl/ssl_engine_config.c modules/ssl/ssl_engine_init.c modules/ssl/ssl_private.h
Author: jorton
Date: Thu May 9 09:05:38 2024
New Revision: 1917600
URL: http://svn.apache.org/viewvc?rev=1917600&view=rev
Log:
Fail if SSLInsecureRenegotiation is used with mod_ssl, CVE-2009-3555
is now approaching 15 years old.
* modules/ssl/ssl_engine_config.c (ssl_cmd_SSLInsecureRenegotiation):
Fail if used.
(ssl_config_server_new, ssl_config_server_merge): Remove insecure
reneg handling.
* modules/ssl/ssl_engine_init.c (ssl_init_ctx_protocol): Remove
insecure_reneg handling.
Modified:
httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml
httpd/httpd/trunk/modules/ssl/ssl_engine_config.c
httpd/httpd/trunk/modules/ssl/ssl_engine_init.c
httpd/httpd/trunk/modules/ssl/ssl_private.h
Modified: httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml?rev=1917600&r1=1917599&r2=1917600&view=diff
==============================================================================
--- httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml (original)
+++ httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml Thu May 9 09:05:38 2024
@@ -2624,50 +2624,6 @@ all queries to OCSP responders.</p>
</directivesynopsis>
<directivesynopsis>
-<name>SSLInsecureRenegotiation</name>
-<description>Option to enable support for insecure renegotiation</description>
-<syntax>SSLInsecureRenegotiation on|off</syntax>
-<default>SSLInsecureRenegotiation off</default>
-<contextlist><context>server config</context>
-<context>virtual host</context></contextlist>
-<compatibility>Available if using OpenSSL 0.9.8m or later</compatibility>
-
-<usage>
-<p>As originally specified, all versions of the SSL and TLS protocols
-(up to and including TLS/1.2) were vulnerable to a Man-in-the-Middle
-attack
-(<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2009-3555">CVE-2009-3555</a>)
-during a renegotiation. This vulnerability allowed an attacker to
-"prefix" a chosen plaintext to the HTTP request as seen by the web
-server. A protocol extension was developed which fixed this
-vulnerability if supported by both client and server.</p>
-
-<p>If <module>mod_ssl</module> is linked against OpenSSL version 0.9.8m
-or later, by default renegotiation is only supported with
-clients supporting the new protocol extension. If this directive is
-enabled, renegotiation will be allowed with old (unpatched) clients,
-albeit insecurely.</p>
-
-<note type="warning"><title>Security warning</title>
-<p>If this directive is enabled, SSL connections will be vulnerable to
-the Man-in-the-Middle prefix attack as described
-in <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2009-3555">CVE-2009-3555</a>.</p>
-</note>
-
-<example><title>Example</title>
-<highlight language="config">
-SSLInsecureRenegotiation on
-</highlight>
-</example>
-
-<p>The <code>SSL_SECURE_RENEG</code> environment variable can be used
-from an SSI or CGI script to determine whether secure renegotiation is
-supported for a given SSL connection.</p>
-
-</usage>
-</directivesynopsis>
-
-<directivesynopsis>
<name>SSLUseStapling</name>
<description>Enable stapling of OCSP responses in the TLS handshake</description>
<syntax>SSLUseStapling on|off</syntax>
Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_config.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_config.c?rev=1917600&r1=1917599&r2=1917600&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_engine_config.c (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_engine_config.c Thu May 9 09:05:38 2024
@@ -214,7 +214,6 @@ static SSLSrvConfigRec *ssl_config_serve
sc->vhost_id = NULL; /* set during module init */
sc->session_cache_timeout = UNSET;
sc->cipher_server_pref = UNSET;
- sc->insecure_reneg = UNSET;
#ifdef HAVE_TLSEXT
sc->strict_sni_vhost_check = SSL_ENABLED_UNSET;
#endif
@@ -348,7 +347,6 @@ void *ssl_config_server_merge(apr_pool_t
cfgMerge(enabled, SSL_ENABLED_UNSET);
cfgMergeInt(session_cache_timeout);
cfgMergeBool(cipher_server_pref);
- cfgMergeBool(insecure_reneg);
#ifdef HAVE_TLSEXT
cfgMerge(strict_sni_vhost_check, SSL_ENABLED_UNSET);
#endif
@@ -983,14 +981,7 @@ const char *ssl_cmd_SSLSessionTickets(cm
const char *ssl_cmd_SSLInsecureRenegotiation(cmd_parms *cmd, void *dcfg, int flag)
{
-#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
- SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
- sc->insecure_reneg = flag?TRUE:FALSE;
- return NULL;
-#else
- return "The SSLInsecureRenegotiation directive is not available "
- "with this SSL library";
-#endif
+ return "The SSLInsecureRenegotiation directive is no longer supported";
}
@@ -2648,7 +2639,6 @@ static void ssl_srv_dump(SSLSrvConfigRec
modssl_ctx_dump(sc->server, p, 0, out, indent, psep);
DMP_LONG( "SSLSessionCacheTimeout", sc->session_cache_timeout);
- DMP_ON_OFF("SSLInsecureRenegotiation", sc->insecure_reneg);
DMP_ON_OFF("SSLStrictSNIVHostCheck", sc->strict_sni_vhost_check);
DMP_ON_OFF("SSLSessionTickets", sc->session_tickets);
}
Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_init.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_init.c?rev=1917600&r1=1917599&r2=1917600&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_engine_init.c (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_engine_init.c Thu May 9 09:05:38 2024
@@ -847,12 +847,6 @@ static apr_status_t ssl_init_ctx_protoco
}
#endif
-#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
- if (sc->insecure_reneg == TRUE) {
- SSL_CTX_set_options(ctx, SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);
- }
-#endif
-
SSL_CTX_set_app_data(ctx, s);
/*
Modified: httpd/httpd/trunk/modules/ssl/ssl_private.h
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_private.h?rev=1917600&r1=1917599&r2=1917600&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_private.h (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_private.h Thu May 9 09:05:38 2024
@@ -825,7 +825,6 @@ struct SSLSrvConfigRec {
const unsigned char *vhost_md5; /* = ap_md5_binary(vhost_id, ...) */
int session_cache_timeout;
BOOL cipher_server_pref;
- BOOL insecure_reneg;
modssl_ctx_t *server;
#ifdef HAVE_TLSEXT
ssl_enabled_t strict_sni_vhost_check;